aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
...
| * ci: split test jobs for faster checksLibravatar Kelvin M. Klann2023-08-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Considering the most recent runs, this reduces the total amount of time it takes to run the tests from about 9-10 minutes to about 3 minutes. Note: Which jobs are split is mostly determined by how long each test takes. For example, this is the time each test step took in a run of `build_and_test` (10m17s total for the job) on commit bfcf8bc31 ("Merge pull request #5956 from kmk3/build-fix-dep-syntax", 2023-08-14)[1]: * 17s test-seccomp-extra * 1s test-firecfg * 16s test-capabilities * 6s test-apparmor * 10s test-appimage * 10s test-chroot * 41s test-sysutils * 24s test-private-etc * 40s test-profiles * 4s test-fcopy * 2s test-fnetfilter * 98s test-fs * 103s test-utils * 57s test-environment * 69s test-network [1]: https://github.com/netblue30/firejail/actions/runs/5860927500/job/15890009169
| * docs: add missing CI badges to README.mdLibravatar Kelvin M. Klann2023-08-22
| |
| * ci: move main code checks into new check-c.ymlLibravatar Kelvin M. Klann2023-08-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move scan-build, cppcheck and CodeQL (cpp). This is similar to build-extra.yml, but for jobs that check for issues in the code rather than checking for build failures. Note: As this deletes codeql-analysis.yml, its configuration also has to be deleted in the GitHub web UI to prevent it from warning about the file being missing: * Security -> Code scanning -> Tool status -> (Setup Types) CodeQL -> (Configurations) language:python -> Delete configuration Misc: The above was clarified by @topimiettinen[1]. [1] https://github.com/netblue30/firejail/pull/5960#issuecomment-1685262643
| * ci: run make in parallel where applicableLibravatar Kelvin M. Klann2023-08-22
| | | | | | | | | | | | | | Do so when the output of the given job is not important. For example, when the output of another job can be used for debugging build-related issues.
| * ci: split build and test into separate workflowsLibravatar Kelvin M. Klann2023-08-22
| | | | | | | | | | Testing takes significantly longer than building, so this makes the default build check faster.
| * ci: remove "CI" from workflow namesLibravatar Kelvin M. Klann2023-08-20
| | | | | | | | All of the current workflows are used for CI.
| * ci: move codeql python job into its own workflowLibravatar Kelvin M. Klann2023-08-20
| | | | | | | | Only run the CodeQL Python analysis if a .py file is changed.
| * ci: trim comments in codeql-analysis.ymlLibravatar Kelvin M. Klann2023-08-20
| | | | | | | | | | Note: When generating a new workflow, the permissions do not have comments anymore.
| * ci: rename profile-checks.yml to check-profiles.ymlLibravatar Kelvin M. Klann2023-08-20
| |
| * ci: use path whitelists instead of blacklistsLibravatar Kelvin M. Klann2023-08-20
| | | | | | | | | | | | | | | | | | | | That is, replace `paths-ignore` with `paths`. This should reduce the number of unnecessary workflow executions and the frequency at which paths are changed. It also reduces the overall number of paths used. Also, add the missing ci/printenv.sh to the path whitelists.
* | test: disable broken sysutils strings testLibravatar Kelvin M. Klann2023-08-23
| | | | | | | | | | | | | | | | | | | | And limit the output of `diff` in the test to avoid logging thousands of lines of a hexdump. Likely broken by commit 3077b2d1f ("update disable-devel.inc", 2023-08-22)[1]. [1] https://github.com/netblue30/firejail/actions/runs/5945120115/job/16123622451
* | update disable-devel.incLibravatar netblue302023-08-22
| |
* | a second round of blacklisting in disable-common.incLibravatar netblue302023-08-22
| |
* | Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302023-08-22
|\ \
| * | profiles: restore entries for ssh-related pathsLibravatar Kelvin M. Klann2023-08-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This partially reverts commit d94f54736 ("disable all ssh utilities in disable-common.inc", 2023-08-20). Certain files in ~/.ssh are only used by sshd (not by ssh), so always blacklist them. Also, ssh itself does not need write access to the configuration files, so make them read-only by default. For details, see commit 2ec3f3a96 ("disable-common.inc: add missing openssh paths", 2021-01-09) / PR #3885. Cc: @netblue30
| * | tests: fix error when /dev/kmsg is missingLibravatar Kelvin M. Klann2023-08-21
| | | | | | | | | | | | | | | | | | | | | This is breaking test-fs in CI since at least commit f37cd57cd ("disable all /bin/dpkg* programs in disable-common.inc", 2023-08-20)[1]. [1] https://github.com/netblue30/firejail/actions/runs/5918495917/job/16062400120
* | | more appimage fixesLibravatar netblue302023-08-22
|/ /
* | disable all /bin/dpkg* programs in disable-common.incLibravatar netblue302023-08-20
| |
* | disable all ssh utilities in disable-common.incLibravatar netblue302023-08-20
| |
* | more domains for static-ip-mapLibravatar netblue302023-08-20
| |
* | adding private-tmp and private-dev to default.profileLibravatar netblue302023-08-20
| |
* | appimage fixesLibravatar netblue302023-08-20
|/
* Merge pull request #5956 from kmk3/build-fix-dep-syntaxLibravatar Kelvin M. Klann2023-08-14
|\ | | | | build: add missing makefile dep & syntax improvements
| * build: improve char escaping of syntax listsLibravatar Kelvin M. Klann2023-08-14
| | | | | | | | | | | | | | | | | | | | | | | | Escape `.` only when generating the syntax files rather than directly in the syntax lists, so that the latter contain the command names as is. This also makes the escaping apply to the arg1 syntax list as well. Note: Double escaping (`\\\\.`) is used in `regex_fromlf` because its output is used in another sed replacement (where it needs to be `\\.`). Relates to #5627.
| * build: print syntax list generationLibravatar Kelvin M. Klann2023-08-12
| | | | | | | | Relates to #5627.
| * build: add missing makefile depLibravatar Kelvin M. Klann2023-08-12
| | | | | | | | | | | | | | | | | | | | Make the non-phony targets that are defined in the root Makefile depend on it, to ensure that they get re-generated if their recipes change. Note that these targets are generated nearly instantly, so this should not noticeably affect rebuild times. Relates to #5627.
* | Merge pull request #5955 from kmk3/build-codespell-improvementsLibravatar Kelvin M. Klann2023-08-14
|\ \ | | | | | | build: codespell improvements
| * | build: run codespell on almost all filesLibravatar Kelvin M. Klann2023-08-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ignore only third-party/vendored files (such as license files and files in m4/). And ignore more words to fix the following errors: $ make codespell Running codespell... ./README:484: als ==> also ./README:646: Shotcut ==> Shortcut ./RELNOTES:516: als ==> also ./etc/inc/disable-common.inc:506: chage ==> change, charge ./etc/apparmor/firejail-default:35: readby ==> read, read by ./etc/apparmor/firejail-default:36: readby ==> read, read by ./etc/profile-a-l/als.profile:1: als ==> also ./etc/profile-a-l/als.profile:5: als ==> also make: *** [Makefile:374: codespell] Error 65 $ codespell --version 2.2.5
| * | ci: run ./configure in codespellLibravatar Kelvin M. Klann2023-08-14
| | | | | | | | | | | | | | | Since it runs through make, the target may depend on variables that are defined by ./configure (such as the ones in config.mk).
| * | ci: move codespell job into its own workflowLibravatar Kelvin M. Klann2023-08-14
| | | | | | | | | | | | | | | Split the spellchecking job from the build-related jobs to make debugging easier.
| * | build: codespell: remove dependency on "clean"Libravatar Kelvin M. Klann2023-08-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It works just fine without it (at least for the files in src/). Note that by default codespell does not warn about binary files ("The default mask is 34"): $ make -j "$(nproc)" >/dev/null $ make codespell codespell --ignore-regex "UE|creat|doas|ether|isplay|shotcut" src test $ codespell --version 2.2.5 $ codespell --help [...] -q QUIET_LEVEL, --quiet-level QUIET_LEVEL bitmask that allows suppressing messages: - 0: print all messages. - 1: disable warnings about wrong encoding. - 2: disable warnings about binary files. - 4: omit warnings about automatic fixes that were disabled in the dictionary. - 8: don't print anything for non-automatic fixes. - 16: don't print the list of fixed files. - 32: don't print configuration files. As usual with bitmasks, these levels can be combined; e.g. use 3 for levels 1+2, 7 for 1+2+4, 23 for 1+2+4+16, etc. The default mask is 34. Also, note that adding many ignore patterns (such as all of the ones in .gitignore) makes it slower than letting codespell find and skip binary files by itself. So just add the most common ones, which do not noticeably change how fast codespell runs either but they do reduce the noise when running with `-q 0`. Homepage: https://github.com/codespell-project/codespell Added on commit d78fc96ee ("codespell github action", 2023-03-05).
| * | build: fix codespell errors in more filesLibravatar Kelvin M. Klann2023-08-13
| |/ | | | | | | | | | | Found by simply running `codespell .`. Environment: codespell 2.2.5-2 on Artix Linux.
* | build(deps): bump github/codeql-action from 2.21.2 to 2.21.3Libravatar dependabot[bot]2023-08-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.21.2 to 2.21.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/0ba4244466797eb048eb91a6cd43d5c03ca8bd05...5b6282e01c62d02e720b81eb8a51204f527c3624) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | mpd: allow MPRIS2 (#5951)Libravatar glitsj162023-08-13
|/ | | | | mpDris2 brings MPRIS2 support to MPD: https://github.com/eonpatapon/mpDris2
* build: fix wrong man page pathsLibravatar Kelvin M. Klann2023-08-12
| | | | | | | Change the old .txt paths into the new .in paths. This amends commit 76bd5ad0f ("build: simplify code related to man pages", 2023-07-12) / PR #5898.
* ani-cli.profile: allow mktemp (#5954)Libravatar pirate4867431862023-08-12
|
* build: fix TARNAME/VERSION variables in compile.shLibravatar Kelvin M. Klann2023-08-12
| | | | | | | | | | | | | This fixes the following errors: $ make clean [...] cd test/compile; ./compile.sh --clean; cd ../.. ./compile.sh: line 55: TARNAME: command not found ./compile.sh: line 55: VERSION: command not found This amends commit 200f389ed ("build: use config.sh in more scripts", 2023-07-28) / PR #5927.
* Merge pull request #5953 from varunsh-coder/update-harden-runnerLibravatar Kelvin M. Klann2023-08-12
|\ | | | | build(deps): Update step-security/harden-runner and update allowed endpoints
| * Update allowed endpointsLibravatar Varun Sharma2023-08-12
| | | | | | | | Signed-off-by: Varun Sharma <varunsh@stepsecurity.io>
| * build(deps): bump step-security/harden-runner from 2.5.0 to 2.5.1Libravatar Varun Sharma2023-08-12
|/ | | | Signed-off-by: Varun Sharma <varunsh@stepsecurity.io>
* build: fix codespell errorsLibravatar Kelvin M. Klann2023-08-12
| | | | | | | | | | | | | | | | | | | | | This fixes the following errors: $ make codespell [...] codespell --ignore-regex "UE|creat|doas|shotcut|ether" src test src/firemon/procevent.c:188: duble ==> double src/fnettrace/main.c:30: postive ==> positive src/fnettrace/main.c:30: defiend ==> defined src/fnettrace/main.c:482: isplay ==> display make: *** [Makefile:371: codespell] Error 65 $ codespell --version 2.2.5 Added in the following commits: * bef5d86a1 ("increase socket buffer size for firemon, bug #2700", 2019-09-29) * c4962789f ("nettrace stats", 2023-08-08)
* small nettrace updateLibravatar netblue302023-08-11
|
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302023-08-11
|\
| * profiles: improvements to profiles using private (#5946)Libravatar glitsj162023-08-11
| | | | | | | | | | | | | | | | | | Changes: * comment `include whitelist-common.inc` when using `private` * drop `private` on profiles that access files in `${HOME}` * use `#` in comments Relates to #903.
| * 0ad.profile: fix libmozjs error on OpenSUSE Tumbleweed (#5944)Libravatar leukimi2023-08-11
| | | | | | | | | | | | | | This fixes 0ad not opening on OpenSUSE Tumbleweed due to a "Permission denied" error when trying to open "libmozjs-78.so.0". See this issue that describes it all: https://github.com/netblue30/firejail/issues/5938#issue-1833607321
| * New profile: clac (#5947)Libravatar glitsj162023-08-10
| | | | | | | | | | * firecfg.config: add support for clac * Create clac.profile
| * New profile: journal-viewer (#5943)Libravatar glitsj162023-08-10
| |
| * Merge pull request #5942 from kmk3/build-firecfg-improvementsLibravatar Kelvin M. Klann2023-08-06
| |\ | | | | | | build: firecfg.config sorting improvements
| | * build: use ASCII sort on firecfg and check for duplicatesLibravatar Kelvin M. Klann2023-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the CI check does not consider certain special characters (such as `-`) when sorting due to `sort -d`. So remove `-d`, sort firecfg using `LC_ALL=C` and enforce that order. Also add `sort -u` to check for duplicates. This also allows the CI check to ignore normal comments (lines starting with `# `) anywhere in the file. Relates to #4643.
| | * build: improve comments in firecfg.configLibravatar Kelvin M. Klann2023-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the space after `#` for commented code and use `#` instead of `-` for comments at the end of the line. Commands used to search and replace: $ f=src/firecfg/firecfg.config; printf '%s\n' "$(sed -E \ -e '3,9999s/^# /#/' \ -e '3,9999s/^#([^ ]+) --? /#\1 # /' \ "$f")" >"$f"
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-03 21:41:56 +0000